import type { AdminPermission } from "@/lib/auth/rbac";

/**
 * Map admin API path + method → required permission.
 * Returns null when only staff membership is required (no finer check).
 */
export function resolveAdminRoutePermission(
  method: string,
  path: string,
): AdminPermission | AdminPermission[] | null {
  const write = !["GET", "HEAD", "OPTIONS"].includes(method.toUpperCase());
  const p = path.split("?")[0];

  if (p.startsWith("/team")) return write ? "team:write" : "team";
  if (p.startsWith("/activity")) return "activity";

  if (p.startsWith("/withdrawals")) return write ? "withdrawals:write" : "withdrawals";
  if (p.startsWith("/reconciliation")) return "reconciliation";
  if (p.startsWith("/refunds")) return write ? "refunds:write" : "reconciliation";
  if (p.match(/^\/bookings\/[^/]+\/refund/)) return "refunds:write";
  if (p.startsWith("/payments")) return "payments";

  if (p.startsWith("/wallet")) return write ? "wallets:write" : "wallets";
  if (p.startsWith("/wallets")) return "wallets";
  if (p.startsWith("/loyalty")) return write ? "wallets:write" : "wallets";

  if (p.startsWith("/coupons")) return write ? "coupons:write" : "coupons";
  if (p.startsWith("/refund-policy")) return write ? "refundPolicy:write" : "refundPolicy";
  if (p.startsWith("/commerce")) return write ? "commerce:write" : "commerce";
  if (p.startsWith("/rates") || p.startsWith("/exchange")) {
    return write ? "rates:write" : "rates";
  }

  if (p.startsWith("/properties")) return write ? "properties:write" : "properties";
  if (p.startsWith("/reviews")) return write ? "reviews:write" : "reviews";
  if (p.startsWith("/users")) return write ? "users:write" : "users";
  if (p.startsWith("/messages") || p.startsWith("/contact")) {
    return write ? "messages:write" : "messages";
  }
  if (p.startsWith("/bookings")) return write ? "bookings:write" : "bookings";
  if (p.startsWith("/analytics") || p === "/" || p === "") return "overview";
  if (p.startsWith("/cities")) return write ? "properties:write" : "properties";

  // Unknown mutating admin route: require SUPER-level team write as safe default
  if (write) return "team:write";
  return "overview";
}